@fuzdev/fuz_app 0.94.0 → 0.96.0

package/dist/auth/account_queries.d.ts

@@ -159,14 +159,29 @@ export declare const query_account_has_any: (deps: QueryDeps) => Promise<boolean
  */
 export declare const query_create_actor: (deps: QueryDeps, account_id: string, name: string) => Promise<Actor>;
 /**
- * List every actor on an account, ordered by `created_at`.
- *
- * Used by `resolve_acting_actor` to resolve the acting actor for a
- * request: 1 actor picks transparently, multiple require an explicit
- * `acting` field on the request payload. For lookups by id, use
+ * List every actor on an account, ordered by `created_at`, **including
+ * soft-deleted (tombstoned) rows**.
+ *
+ * Used by the admin/snapshot handlers (`account_delete` / `account_purge` /
+ * `account_undelete`) that must enumerate every actor that ever existed on
+ * the account to snapshot names into per-actor audit events. For the
+ * acting-actor resolution path — which must never resolve a tombstoned
+ * actor — use `query_active_actors_by_account`. For lookups by id, use
  * `query_actor_by_id` instead.
  */
 export declare const query_actors_by_account: (deps: QueryDeps, account_id: string) => Promise<Array<Actor>>;
+/**
+ * List **active** (non-tombstoned) actors on an account, ordered by
+ * `created_at`.
+ *
+ * Filters `deleted_at IS NULL` so a soft-deleted actor can never be resolved
+ * as the acting actor (and carry its `role_grants` into the role gate). Used
+ * by `resolve_acting_actor` to resolve the acting actor for a request: 1
+ * actor picks transparently, multiple require an explicit `acting` field on
+ * the request payload. The admin/snapshot handlers that legitimately need
+ * tombstoned rows stay on the unfiltered `query_actors_by_account`.
+ */
+export declare const query_active_actors_by_account: (deps: QueryDeps, account_id: string) => Promise<Array<Actor>>;
 /**
  * Find an actor by id.
  */

package/dist/auth/account_queries.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"account_queries.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/account_queries.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,OAAO,KAAK,EAAC,SAAS,EAAC,MAAM,qBAAqB,CAAC;AAEnD,OAAO,EAEN,KAAK,OAAO,EACZ,KAAK,KAAK,EACV,KAAK,kBAAkB,EACvB,KAAK,qBAAqB,EAC1B,MAAM,qBAAqB,CAAC;AAqB7B;;;;;;;GAOG;AACH,eAAO,MAAM,oBAAoB,GAChC,MAAM,SAAS,EACf,OAAO,kBAAkB,KACvB,OAAO,CAAC,OAAO,CAQjB,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,mBAAmB,GAC/B,MAAM,SAAS,EACf,IAAI,MAAM,KACR,OAAO,CAAC,OAAO,GAAG,SAAS,CAK7B,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,yBAAyB,GACrC,MAAM,SAAS,EACf,UAAU,MAAM,KACd,OAAO,CAAC,OAAO,GAAG,SAAS,CAK7B,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,sBAAsB,GAClC,MAAM,SAAS,EACf,OAAO,MAAM,KACX,OAAO,CAAC,OAAO,GAAG,SAAS,CAK7B,CAAC;AAEF;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,kCAAkC,GAC9C,MAAM,SAAS,EACf,OAAO,MAAM,KACX,OAAO,CAAC,OAAO,GAAG,SAAS,CAS7B,CAAC;AAEF;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,6BAA6B,GACzC,MAAM,SAAS,EACf,IAAI,MAAM,EACV,eAAe,MAAM,EACrB,YAAY,MAAM,GAAG,IAAI,EACzB,eAAe,MAAM,KACnB,OAAO,CAAC,OAAO,CAQjB,CAAC;AAEF;;;;GAIG;AACH,MAAM,WAAW,uBAAuB;IACvC,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CACrB;AAED;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,yBAAyB,GACrC,MAAM,SAAS,EACf,IAAI,MAAM,EACV,YAAY,MAAM,GAAG,IAAI,KACvB,OAAO,CAAC,uBAAuB,GAAG,SAAS,CAO7C,CAAC;AAEF;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,mBAAmB,GAC/B,MAAM,SAAS,EACf,IAAI,MAAM,KACR,OAAO,CAAC,uBAAuB,GAAG,SAAS,CAK7C,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,uBAAuB,GACnC,MAAM,SAAS,EACf,IAAI,MAAM,EACV,YAAY,MAAM,GAAG,IAAI,KACvB,OAAO,CAAC,OAAO,CAQjB,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,sBAAsB,GAClC,MAAM,SAAS,EACf,IAAI,MAAM,KACR,OAAO,CAAC,uBAAuB,GAAG,SAAS,CAO7C,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,GAAU,MAAM,SAAS,EAAE,IAAI,MAAM,KAAG,OAAO,CAAC,OAAO,CAQvF,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,qBAAqB,GAAU,MAAM,SAAS,KAAG,OAAO,CAAC,OAAO,CAK5E,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,kBAAkB,GAC9B,MAAM,SAAS,EACf,YAAY,MAAM,EAClB,MAAM,MAAM,KACV,OAAO,CAAC,KAAK,CAMf,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,uBAAuB,GACnC,MAAM,SAAS,EACf,YAAY,MAAM,KAChB,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAKtB,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,iBAAiB,GAC7B,MAAM,SAAS,EACf,IAAI,MAAM,KACR,OAAO,CAAC,KAAK,GAAG,SAAS,CAE3B,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,+BAA+B,GAC3C,MAAM,SAAS,EACf,OAAO,kBAAkB,KACvB,OAAO,CAAC;IAAC,OAAO,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,KAAK,CAAA;CAAC,CAI1C,CAAC;AA2BF,8CAA8C;AAC9C,MAAM,WAAW,uBAAuB;IACvC;;;;;OAKG;IACH,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,wCAAwC;IACxC,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB;;;;;OAKG;IACH,eAAe,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC;CACjC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,wBAAwB,GACpC,MAAM,SAAS,EACf,UAAU,uBAAuB,KAC/B,OAAO,CAAC,KAAK,CAAC,qBAAqB,CAAC,CA8GtC,CAAC"}
+{"version":3,"file":"account_queries.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/account_queries.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,OAAO,KAAK,EAAC,SAAS,EAAC,MAAM,qBAAqB,CAAC;AAEnD,OAAO,EAEN,KAAK,OAAO,EACZ,KAAK,KAAK,EACV,KAAK,kBAAkB,EACvB,KAAK,qBAAqB,EAC1B,MAAM,qBAAqB,CAAC;AAqB7B;;;;;;;GAOG;AACH,eAAO,MAAM,oBAAoB,GAChC,MAAM,SAAS,EACf,OAAO,kBAAkB,KACvB,OAAO,CAAC,OAAO,CAQjB,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,mBAAmB,GAC/B,MAAM,SAAS,EACf,IAAI,MAAM,KACR,OAAO,CAAC,OAAO,GAAG,SAAS,CAK7B,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,yBAAyB,GACrC,MAAM,SAAS,EACf,UAAU,MAAM,KACd,OAAO,CAAC,OAAO,GAAG,SAAS,CAK7B,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,sBAAsB,GAClC,MAAM,SAAS,EACf,OAAO,MAAM,KACX,OAAO,CAAC,OAAO,GAAG,SAAS,CAK7B,CAAC;AAEF;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,kCAAkC,GAC9C,MAAM,SAAS,EACf,OAAO,MAAM,KACX,OAAO,CAAC,OAAO,GAAG,SAAS,CAS7B,CAAC;AAEF;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,6BAA6B,GACzC,MAAM,SAAS,EACf,IAAI,MAAM,EACV,eAAe,MAAM,EACrB,YAAY,MAAM,GAAG,IAAI,EACzB,eAAe,MAAM,KACnB,OAAO,CAAC,OAAO,CAQjB,CAAC;AAEF;;;;GAIG;AACH,MAAM,WAAW,uBAAuB;IACvC,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CACrB;AAED;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,yBAAyB,GACrC,MAAM,SAAS,EACf,IAAI,MAAM,EACV,YAAY,MAAM,GAAG,IAAI,KACvB,OAAO,CAAC,uBAAuB,GAAG,SAAS,CAO7C,CAAC;AAEF;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,mBAAmB,GAC/B,MAAM,SAAS,EACf,IAAI,MAAM,KACR,OAAO,CAAC,uBAAuB,GAAG,SAAS,CAK7C,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,uBAAuB,GACnC,MAAM,SAAS,EACf,IAAI,MAAM,EACV,YAAY,MAAM,GAAG,IAAI,KACvB,OAAO,CAAC,OAAO,CAQjB,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,sBAAsB,GAClC,MAAM,SAAS,EACf,IAAI,MAAM,KACR,OAAO,CAAC,uBAAuB,GAAG,SAAS,CAO7C,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,GAAU,MAAM,SAAS,EAAE,IAAI,MAAM,KAAG,OAAO,CAAC,OAAO,CAQvF,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,qBAAqB,GAAU,MAAM,SAAS,KAAG,OAAO,CAAC,OAAO,CAK5E,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,kBAAkB,GAC9B,MAAM,SAAS,EACf,YAAY,MAAM,EAClB,MAAM,MAAM,KACV,OAAO,CAAC,KAAK,CAMf,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,uBAAuB,GACnC,MAAM,SAAS,EACf,YAAY,MAAM,KAChB,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAKtB,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,8BAA8B,GAC1C,MAAM,SAAS,EACf,YAAY,MAAM,KAChB,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAKtB,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,iBAAiB,GAC7B,MAAM,SAAS,EACf,IAAI,MAAM,KACR,OAAO,CAAC,KAAK,GAAG,SAAS,CAE3B,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,+BAA+B,GAC3C,MAAM,SAAS,EACf,OAAO,kBAAkB,KACvB,OAAO,CAAC;IAAC,OAAO,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,KAAK,CAAA;CAAC,CAI1C,CAAC;AA2BF,8CAA8C;AAC9C,MAAM,WAAW,uBAAuB;IACvC;;;;;OAKG;IACH,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,wCAAwC;IACxC,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB;;;;;OAKG;IACH,eAAe,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC;CACjC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,wBAAwB,GACpC,MAAM,SAAS,EACf,UAAU,uBAAuB,KAC/B,OAAO,CAAC,KAAK,CAAC,qBAAqB,CAAC,CA8GtC,CAAC"}

package/dist/auth/account_queries.js

@@ -218,16 +218,33 @@ export const query_create_actor = async (deps, account_id, name) => {
     return assert_row(row, 'INSERT INTO actor');
 };
 /**
- * List every actor on an account, ordered by `created_at`.
+ * List every actor on an account, ordered by `created_at`, **including
+ * soft-deleted (tombstoned) rows**.
  *
- * Used by `resolve_acting_actor` to resolve the acting actor for a
- * request: 1 actor picks transparently, multiple require an explicit
- * `acting` field on the request payload. For lookups by id, use
+ * Used by the admin/snapshot handlers (`account_delete` / `account_purge` /
+ * `account_undelete`) that must enumerate every actor that ever existed on
+ * the account to snapshot names into per-actor audit events. For the
+ * acting-actor resolution path — which must never resolve a tombstoned
+ * actor — use `query_active_actors_by_account`. For lookups by id, use
  * `query_actor_by_id` instead.
  */
 export const query_actors_by_account = async (deps, account_id) => {
     return deps.db.query(`SELECT * FROM actor WHERE account_id = $1 ORDER BY created_at ASC, id ASC`, [account_id]);
 };
+/**
+ * List **active** (non-tombstoned) actors on an account, ordered by
+ * `created_at`.
+ *
+ * Filters `deleted_at IS NULL` so a soft-deleted actor can never be resolved
+ * as the acting actor (and carry its `role_grants` into the role gate). Used
+ * by `resolve_acting_actor` to resolve the acting actor for a request: 1
+ * actor picks transparently, multiple require an explicit `acting` field on
+ * the request payload. The admin/snapshot handlers that legitimately need
+ * tombstoned rows stay on the unfiltered `query_actors_by_account`.
+ */
+export const query_active_actors_by_account = async (deps, account_id) => {
+    return deps.db.query(`SELECT * FROM actor WHERE account_id = $1 AND deleted_at IS NULL ORDER BY created_at ASC, id ASC`, [account_id]);
+};
 /**
  * Find an actor by id.
  */

package/dist/auth/request_context.js

@@ -36,7 +36,7 @@
  */
 import { is_role_grant_active } from './account_schema.js';
 import { hash_session_token, session_touch_fire_and_forget, query_session_get_valid, } from './session_queries.js';
-import { query_account_by_id, query_actor_by_id, query_actors_by_account, } from './account_queries.js';
+import { query_account_by_id, query_actor_by_id, query_active_actors_by_account, } from './account_queries.js';
 import { query_role_grant_find_active_for_actor } from './role_grant_queries.js';
 import { ACCOUNT_ID_KEY, AUTH_API_TOKEN_ID_KEY, CREDENTIAL_TYPE_KEY, TEST_CONTEXT_PRESET_KEY, } from '../hono_context.js';
 import { is_public_auth, needs_actor } from '../http/auth_shape.js';
@@ -174,7 +174,7 @@ export const has_any_scoped_role = (ctx, roles, scope_id, now = new Date()) => {
  * @param acting_actor_id - the requested acting actor id, or `undefined`
  */
 export const resolve_acting_actor = async (deps, account_id, acting_actor_id) => {
-    const actors = await query_actors_by_account(deps, account_id);
+    const actors = await query_active_actors_by_account(deps, account_id);
     if (actors.length === 0)
         return { ok: false, reason: 'no_actors' };
     if (acting_actor_id == null) {

package/dist/db/CLAUDE.md

@@ -15,9 +15,12 @@ the code.
 - `db.ts` — `Db` abstraction over pg + PGlite, `query` / `query_one` /
   `transaction`, `no_nested_transaction` guard.
 - `create_db.ts` — URL-based driver auto-detection (`postgres` /
-  `pglite-file` / `pglite-memory`); registers the int8 parser so
-  `BIGSERIAL` columns read as JS numbers.
-- `db_pg.ts` / `db_pglite.ts` — driver adapters.
+  `pglite-file` / `pglite-memory`).
+- `db_pg.ts` / `db_pglite.ts` — driver adapters. `db_pg.ts` also exports
+  `register_pg_type_parsers`, the shared int8→number coercion (so
+  `BIGSERIAL` columns read as JS numbers, matching PGlite) — called by both
+  `create_db` and the test pg factory (`testing/db.ts`) so prod and tests
+  read the same wire shape from one registration site.
 - `migrate.ts` — advisory-lock migration runner (`run_migrations`,
   `baseline`), `Migration` / `MigrationNamespace` / `MigrationError`.
 - `query_deps.ts` — `QueryDeps = {db}`, the first param to every `query_*`.

package/dist/db/cell_queries.js

@@ -394,8 +394,15 @@ const build_shared_with_sql = (order_column, order_direction) => `${CALLER_ROLE_
  * Returns `null` (rather than `[]`) when no refs are present — the column
  * is nullable and the `idx_cell_refs` partial index is `WHERE refs IS NOT
  * NULL`, so an empty array would force every cell into the index.
+ *
+ * Sorts the deduped refs lexicographically so the stored `text[]` is
+ * deterministic and byte-identical to the Rust twin (`fuz_cell`'s
+ * `extract_refs`, which sorts the same `blake3:`-prefixed element form).
+ * The shared `fact_hash_extract_refs` deliberately preserves traversal
+ * order per its contract, so the sort lives here at the storage boundary,
+ * not in the util.
  */
 const derive_refs = (data) => {
     const refs = fact_hash_extract_refs(data);
-    return refs.length > 0 ? refs : null;
+    return refs.length > 0 ? refs.sort() : null;
 };

package/dist/db/create_db.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"create_db.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/db/create_db.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAC,EAAE,EAAE,MAAM,EAAC,MAAM,SAAS,CAAC;AAIxC,yCAAyC;AACzC,MAAM,WAAW,cAAc;IAC9B,EAAE,EAAE,EAAE,CAAC;IACP,iFAAiF;IACjF,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,SAAS,GAAU,cAAc,MAAM,KAAG,OAAO,CAAC,cAAc,CA6C5E,CAAC"}
+{"version":3,"file":"create_db.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/db/create_db.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAC,EAAE,EAAE,MAAM,EAAC,MAAM,SAAS,CAAC;AAIxC,yCAAyC;AACzC,MAAM,WAAW,cAAc;IAC9B,EAAE,EAAE,EAAE,CAAC;IACP,iFAAiF;IACjF,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,SAAS,GAAU,cAAc,MAAM,KAAG,OAAO,CAAC,cAAc,CAiC5E,CAAC"}

package/dist/db/create_db.js

@@ -12,7 +12,7 @@
  *
  * @module
  */
-import { create_pg_db } from './db_pg.js';
+import { create_pg_db, register_pg_type_parsers } from './db_pg.js';
 import { create_pglite_db } from './db_pglite.js';
 /**
  * Create a database connection based on a URL.
@@ -32,19 +32,7 @@ import { create_pglite_db } from './db_pglite.js';
 export const create_db = async (database_url) => {
     if (database_url.startsWith('postgres://') || database_url.startsWith('postgresql://')) {
         const { default: pg } = await import('pg');
-        // Parse int8 (BIGINT) as a JS number. pg defaults to returning int8
-        // as a string to avoid 2^53 precision loss; our only int8 column
-        // today (`audit_log.seq`) stays well under that bound, and reading
-        // as number keeps the wire shape uniform across the SERIAL→BIGSERIAL
-        // widening.
-        //
-        // CAVEAT: pg.types.setTypeParser mutates pg.types globally — every
-        // pg.Pool in the process inherits the coercion, including pools the
-        // consumer constructs against unrelated databases. Any future int8
-        // column that could legitimately exceed 2^53 (file sizes, byte
-        // offsets) will silently round; if one lands, localize via a
-        // per-pool `types` override instead of widening this global parser.
-        pg.types.setTypeParser(20, (val) => Number(val));
+        await register_pg_type_parsers();
         const pool = new pg.Pool({ connectionString: database_url });
         const { db, close } = create_pg_db(pool);
         return {

package/dist/db/db_pg.d.ts

@@ -2,13 +2,41 @@
  * PostgreSQL driver adapter for `Db`.
  *
  * Provides `create_pg_db()` to construct a `Db` backed by a `pg.Pool`.
- * Only imports `pg` types — the actual `pg` package is dynamically imported
- * by callers (e.g., `create_db`) that construct the `Pool`.
+ * Statically imports only `pg` types; the `pg` runtime is dynamically
+ * imported where needed — by callers (e.g., `create_db`) that construct the
+ * `Pool`, and by `register_pg_type_parsers` to reach `pg.types`. pglite-only
+ * consumers never reach either path, so `pg` stays an optional peer dep.
  *
  * @module
  */
 import type { Pool } from 'pg';
 import { type DbDriverResult } from './db.js';
+/**
+ * Register the shared pg type-parser overrides on the module-global `pg.types`.
+ *
+ * Dynamically imports the `pg` runtime (so pglite-only consumers, who never
+ * call this, don't need `pg` installed) and coerces int8 (`BIGINT`, OID 20)
+ * to a JS number. pg defaults to returning
+ * int8 as a string to avoid 2^53 precision loss; our int8 columns today
+ * (`audit_log.seq`, `cell_history.id`, `fact.size`) stay well under that
+ * bound, and reading as a number keeps the wire shape uniform with PGlite —
+ * which returns int8 as a number — so `AuditLogEvent.seq` and friends
+ * validate identically across both drivers.
+ *
+ * Both `create_db` (production) and the test pg factory (`testing/db.ts`)
+ * register through this single site so test and prod read the same shape; a
+ * divergence here is exactly the test/prod write-semantics gap the parser
+ * exists to close.
+ *
+ * CAVEAT: `setTypeParser` mutates `pg.types` globally — every `pg.Pool` in
+ * the process inherits the coercion, including pools the consumer constructs
+ * against unrelated databases. Any future int8 column that could legitimately
+ * exceed 2^53 (byte offsets, counters) will silently round; if one lands,
+ * localize via a per-pool `types` override instead of widening this global.
+ *
+ * @mutates `pg.types` - registers the int8 parser on the global pg type registry
+ */
+export declare const register_pg_type_parsers: () => Promise<void>;
 /**
  * Create a `Db` backed by a `pg.Pool`.
  *

package/dist/db/db_pg.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"db_pg.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/db/db_pg.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAC,IAAI,EAAC,MAAM,IAAI,CAAC;AAE7B,OAAO,EAA4B,KAAK,cAAc,EAAC,MAAM,SAAS,CAAC;AA2BvE;;;;;;;;GAQG;AACH,eAAO,MAAM,YAAY,GAAI,MAAM,IAAI,KAAG,cAGxC,CAAC"}
+{"version":3,"file":"db_pg.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/db/db_pg.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAC,IAAI,EAAC,MAAM,IAAI,CAAC;AAE7B,OAAO,EAA4B,KAAK,cAAc,EAAC,MAAM,SAAS,CAAC;AAEvE;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,eAAO,MAAM,wBAAwB,QAAa,OAAO,CAAC,IAAI,CAG7D,CAAC;AA2BF;;;;;;;;GAQG;AACH,eAAO,MAAM,YAAY,GAAI,MAAM,IAAI,KAAG,cAGxC,CAAC"}

package/dist/db/db_pg.js

@@ -2,12 +2,43 @@
  * PostgreSQL driver adapter for `Db`.
  *
  * Provides `create_pg_db()` to construct a `Db` backed by a `pg.Pool`.
- * Only imports `pg` types — the actual `pg` package is dynamically imported
- * by callers (e.g., `create_db`) that construct the `Pool`.
+ * Statically imports only `pg` types; the `pg` runtime is dynamically
+ * imported where needed — by callers (e.g., `create_db`) that construct the
+ * `Pool`, and by `register_pg_type_parsers` to reach `pg.types`. pglite-only
+ * consumers never reach either path, so `pg` stays an optional peer dep.
  *
  * @module
  */
 import { Db, no_nested_transaction } from './db.js';
+/**
+ * Register the shared pg type-parser overrides on the module-global `pg.types`.
+ *
+ * Dynamically imports the `pg` runtime (so pglite-only consumers, who never
+ * call this, don't need `pg` installed) and coerces int8 (`BIGINT`, OID 20)
+ * to a JS number. pg defaults to returning
+ * int8 as a string to avoid 2^53 precision loss; our int8 columns today
+ * (`audit_log.seq`, `cell_history.id`, `fact.size`) stay well under that
+ * bound, and reading as a number keeps the wire shape uniform with PGlite —
+ * which returns int8 as a number — so `AuditLogEvent.seq` and friends
+ * validate identically across both drivers.
+ *
+ * Both `create_db` (production) and the test pg factory (`testing/db.ts`)
+ * register through this single site so test and prod read the same shape; a
+ * divergence here is exactly the test/prod write-semantics gap the parser
+ * exists to close.
+ *
+ * CAVEAT: `setTypeParser` mutates `pg.types` globally — every `pg.Pool` in
+ * the process inherits the coercion, including pools the consumer constructs
+ * against unrelated databases. Any future int8 column that could legitimately
+ * exceed 2^53 (byte offsets, counters) will silently round; if one lands,
+ * localize via a per-pool `types` override instead of widening this global.
+ *
+ * @mutates `pg.types` - registers the int8 parser on the global pg type registry
+ */
+export const register_pg_type_parsers = async () => {
+    const { types } = await import('pg');
+    types.setTypeParser(20, (val) => Number(val));
+};
 /**
  * Create a transaction implementation for a `pg.Pool`.
  *

package/dist/db/fact_queries.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fact_queries.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/db/fact_queries.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAC,SAAS,EAAC,MAAM,iBAAiB,CAAC;AAE/C,OAAO,KAAK,EAAC,QAAQ,EAAC,MAAM,+BAA+B,CAAC;AAE5D,0CAA0C;AAC1C,MAAM,WAAW,OAAO;IACvB,IAAI,EAAE,QAAQ,CAAC;IACf,KAAK,EAAE,UAAU,GAAG,IAAI,CAAC;IACzB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;IACtB,UAAU,EAAE,IAAI,CAAC;CACjB;AAED,qEAAqE;AACrE,MAAM,WAAW,WAAW;IAC3B,IAAI,EAAE,QAAQ,CAAC;IACf,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;IACtB,UAAU,EAAE,IAAI,CAAC;CACjB;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,cAAc,GAC1B,MAAM,SAAS,EACf,OAAO;IACN,IAAI,EAAE,QAAQ,CAAC;IACf,KAAK,EAAE,UAAU,GAAG,IAAI,CAAC;IACzB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,IAAI,EAAE,MAAM,CAAC;CACb,KACC,OAAO,CAAC,OAAO,CASjB,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,GAC/B,MAAM,SAAS,EACf,aAAa,QAAQ,EACrB,eAAe,KAAK,CAAC,QAAQ,CAAC,KAC5B,OAAO,CAAC,IAAI,CAQd,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,cAAc,GAAU,MAAM,SAAS,EAAE,MAAM,QAAQ,KAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAO5F,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,mBAAmB,GAC/B,MAAM,SAAS,EACf,MAAM,QAAQ,KACZ,OAAO,CAAC,WAAW,GAAG,IAAI,CAO5B,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,cAAc,GAAU,MAAM,SAAS,EAAE,MAAM,QAAQ,KAAG,OAAO,CAAC,OAAO,CAMrF,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,mBAAmB,GAC/B,MAAM,SAAS,EACf,aAAa,QAAQ,KACnB,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,CAMzB,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,iBAAiB,GAC7B,MAAM,SAAS,EACf,MAAM,QAAQ,KACZ,OAAO,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;CAAC,GAAG,IAAI,CAQ5D,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,WAAW,qBAAqB;IACrC,KAAK,EAAE,MAAM,CAAC;IACd,gBAAgB,EAAE,MAAM,CAAC;IACzB,MAAM,EAAE,KAAK,CAAC;QACb,IAAI,EAAE,QAAQ,CAAC;QACf,IAAI,EAAE,MAAM,CAAC;QACb,UAAU,EAAE,MAAM,CAAC;QACnB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;KAC5B,CAAC,CAAC;CACH;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,uBAAuB,GACnC,MAAM,SAAS,EACf,YAAY,IAAI,GAAG,IAAI,EACvB,cAAc,MAAM,KAClB,OAAO,CAAC,qBAAqB,CAwC/B,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,oCAAoC,GAChD,MAAM,SAAS,EACf,YAAY,IAAI,KACd,OAAO,CAAC,KAAK,CAAC;IAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;CAAC,CAAC,CAiB5E,CAAC"}
+{"version":3,"file":"fact_queries.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/db/fact_queries.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAC,SAAS,EAAC,MAAM,iBAAiB,CAAC;AAE/C,OAAO,KAAK,EAAC,QAAQ,EAAC,MAAM,+BAA+B,CAAC;AAE5D,0CAA0C;AAC1C,MAAM,WAAW,OAAO;IACvB,IAAI,EAAE,QAAQ,CAAC;IACf,KAAK,EAAE,UAAU,GAAG,IAAI,CAAC;IACzB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAK5B,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;IACtB,UAAU,EAAE,IAAI,CAAC;CACjB;AAED,qEAAqE;AACrE,MAAM,WAAW,WAAW;IAC3B,IAAI,EAAE,QAAQ,CAAC;IACf,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAE5B,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;IACtB,UAAU,EAAE,IAAI,CAAC;CACjB;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,cAAc,GAC1B,MAAM,SAAS,EACf,OAAO;IACN,IAAI,EAAE,QAAQ,CAAC;IACf,KAAK,EAAE,UAAU,GAAG,IAAI,CAAC;IACzB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,IAAI,EAAE,MAAM,CAAC;CACb,KACC,OAAO,CAAC,OAAO,CASjB,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,GAC/B,MAAM,SAAS,EACf,aAAa,QAAQ,EACrB,eAAe,KAAK,CAAC,QAAQ,CAAC,KAC5B,OAAO,CAAC,IAAI,CAQd,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,cAAc,GAAU,MAAM,SAAS,EAAE,MAAM,QAAQ,KAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAO5F,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,mBAAmB,GAC/B,MAAM,SAAS,EACf,MAAM,QAAQ,KACZ,OAAO,CAAC,WAAW,GAAG,IAAI,CAO5B,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,cAAc,GAAU,MAAM,SAAS,EAAE,MAAM,QAAQ,KAAG,OAAO,CAAC,OAAO,CAMrF,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,mBAAmB,GAC/B,MAAM,SAAS,EACf,aAAa,QAAQ,KACnB,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,CAMzB,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,iBAAiB,GAC7B,MAAM,SAAS,EACf,MAAM,QAAQ,KACZ,OAAO,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;CAAC,GAAG,IAAI,CAQ5D,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,WAAW,qBAAqB;IACrC,KAAK,EAAE,MAAM,CAAC;IACd,gBAAgB,EAAE,MAAM,CAAC;IACzB,MAAM,EAAE,KAAK,CAAC;QACb,IAAI,EAAE,QAAQ,CAAC;QACf,IAAI,EAAE,MAAM,CAAC;QACb,UAAU,EAAE,MAAM,CAAC;QACnB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;KAC5B,CAAC,CAAC;CACH;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,uBAAuB,GACnC,MAAM,SAAS,EACf,YAAY,IAAI,GAAG,IAAI,EACvB,cAAc,MAAM,KAClB,OAAO,CAAC,qBAAqB,CAwC/B,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,oCAAoC,GAChD,MAAM,SAAS,EACf,YAAY,IAAI,KACd,OAAO,CAAC,KAAK,CAAC;IAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;CAAC,CAAC,CAiB5E,CAAC"}

package/dist/server/serve_fact_route.d.ts

@@ -63,6 +63,18 @@
  * is the doc cell, so serving goes view-doc-cell → doc-cell-refs-include-hash
  * → serve.
  *
+ * ## Untrusted-content hardening
+ *
+ * Fact bytes are served with a producer-supplied `content_type` emitted
+ * verbatim, inline. To stop a fact stored as (or sniffable to) `text/html`
+ * from executing as stored XSS for any reader of a referencing cell, **every**
+ * served-fact response carries `X-Content-Type-Options: nosniff` +
+ * `Content-Security-Policy: default-src 'none'; sandbox` (the
+ * `FACT_SECURITY_HEADERS` set, applied in all three serve branches). The same
+ * pair, byte-identical, is set by the Rust twin (`fuz_fact_serving::serve`).
+ * `Content-Disposition: attachment` is deliberately **not** added — it would
+ * force-download and break legitimate inline image rendering.
+ *
  * ## Defense-in-depth
  *
  * The `external_url` regex is re-validated before issuing

package/dist/server/serve_fact_route.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"serve_fact_route.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/server/serve_fact_route.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyEG;AAMH,OAAO,KAAK,EAAC,MAAM,EAAC,MAAM,yBAAyB,CAAC;AAepD,OAAO,EAAsC,KAAK,SAAS,EAAC,MAAM,uBAAuB,CAAC;AAE1F,OAAO,KAAK,EAAC,OAAO,EAAC,MAAM,iBAAiB,CAAC;AAsC7C,MAAM,WAAW,+BAA+B;IAC/C;;;;;;OAMG;IACH,IAAI,EAAE,OAAO,CAAC;IACd,kFAAkF;IAClF,SAAS,EAAE,MAAM,CAAC;IAClB;;;;;;OAMG;IACH,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,GAAG,EAAE,MAAM,CAAC;CACZ;AAwGD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,iCAAiC,GAC7C,SAAS,+BAA+B,KACtC,SA8CF,CAAC;AAEF;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,4BAA4B,GACxC,SAAS,+BAA+B,KACtC,SAgCF,CAAC"}
+{"version":3,"file":"serve_fact_route.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/server/serve_fact_route.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqFG;AAMH,OAAO,KAAK,EAAC,MAAM,EAAC,MAAM,yBAAyB,CAAC;AAepD,OAAO,EAAsC,KAAK,SAAS,EAAC,MAAM,uBAAuB,CAAC;AAE1F,OAAO,KAAK,EAAC,OAAO,EAAC,MAAM,iBAAiB,CAAC;AAkE7C,MAAM,WAAW,+BAA+B;IAC/C;;;;;;OAMG;IACH,IAAI,EAAE,OAAO,CAAC;IACd,kFAAkF;IAClF,SAAS,EAAE,MAAM,CAAC;IAClB;;;;;;OAMG;IACH,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,GAAG,EAAE,MAAM,CAAC;CACZ;AA2GD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,iCAAiC,GAC7C,SAAS,+BAA+B,KACtC,SA8CF,CAAC;AAEF;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,4BAA4B,GACxC,SAAS,+BAA+B,KACtC,SAgCF,CAAC"}

package/dist/server/serve_fact_route.js

@@ -63,6 +63,18 @@
  * is the doc cell, so serving goes view-doc-cell → doc-cell-refs-include-hash
  * → serve.
  *
+ * ## Untrusted-content hardening
+ *
+ * Fact bytes are served with a producer-supplied `content_type` emitted
+ * verbatim, inline. To stop a fact stored as (or sniffable to) `text/html`
+ * from executing as stored XSS for any reader of a referencing cell, **every**
+ * served-fact response carries `X-Content-Type-Options: nosniff` +
+ * `Content-Security-Policy: default-src 'none'; sandbox` (the
+ * `FACT_SECURITY_HEADERS` set, applied in all three serve branches). The same
+ * pair, byte-identical, is set by the Rust twin (`fuz_fact_serving::serve`).
+ * `Content-Disposition: attachment` is deliberately **not** added — it would
+ * force-download and break legitimate inline image rendering.
+ *
  * ## Defense-in-depth
  *
  * The `external_url` regex is re-validated before issuing
@@ -92,6 +104,31 @@ import { can_view_cell } from '../auth/cell_authorize.js';
 import { parse_file_fact_url } from '../db/file_fact_url.js';
 /** `Cache-Control` for fact responses — 5 min revocation window. */
 const CACHE_CONTROL = 'private, max-age=300';
+/**
+ * `X-Content-Type-Options` for fact responses — block MIME sniffing so an
+ * `application/octet-stream` fact can't be sniffed into executable HTML.
+ */
+const X_CONTENT_TYPE_OPTIONS = 'nosniff';
+/**
+ * `Content-Security-Policy` for fact responses. Fact bytes carry a
+ * producer-supplied `content_type` served verbatim inline, so a fact stored as
+ * (or sniffable to) `text/html` would otherwise execute as stored XSS for any
+ * reader of a referencing cell. `default-src 'none'; sandbox` neutralizes
+ * script execution and sub-resource loads even when a fact is rendered inline;
+ * harmless for directly-served images (they load no sub-resources). The same
+ * pair, byte-identical, is set by the Rust twin (`fuz_fact_serving::serve`).
+ */
+const CONTENT_SECURITY_POLICY = "default-src 'none'; sandbox";
+/**
+ * The untrusted-content hardening headers applied to every served-fact
+ * response across all three branches (embedded, `X-Accel-Redirect`,
+ * disk-stream). `Content-Disposition: attachment` is deliberately omitted — it
+ * would force-download and break legitimate inline image rendering.
+ */
+const FACT_SECURITY_HEADERS = {
+    'X-Content-Type-Options': X_CONTENT_TYPE_OPTIONS,
+    'Content-Security-Policy': CONTENT_SECURITY_POLICY,
+};
 /**
  * Path-param schema for the bare-hash route. Matching the canonical
  * fact-hash form here pushes malformed-hash 400s through the framework's
@@ -150,6 +187,7 @@ const serve_fact_bytes = async (c, route, hash, config) => {
             'Content-Type': content_type,
             'Content-Length': size,
             'Cache-Control': CACHE_CONTROL,
+            ...FACT_SECURITY_HEADERS,
         });
     }
     // External — defense-in-depth re-validate the URL before trusting it
@@ -167,6 +205,7 @@ const serve_fact_bytes = async (c, route, hash, config) => {
             'Content-Length': size,
             'Cache-Control': CACHE_CONTROL,
             'X-Accel-Redirect': `${x_accel_redirect_prefix}${shard}/${rest}`,
+            ...FACT_SECURITY_HEADERS,
         });
     }
     // Dev / tests: stream from disk. `createReadStream` errors land on the
@@ -178,6 +217,7 @@ const serve_fact_bytes = async (c, route, hash, config) => {
         'Content-Type': content_type,
         'Content-Length': size,
         'Cache-Control': CACHE_CONTROL,
+        ...FACT_SECURITY_HEADERS,
     });
 };
 /**

package/dist/testing/CLAUDE.md

@@ -894,7 +894,10 @@ source of truth for wire-shape conformance.
 - `testing/cross_backend/capabilities.ts` — `BackendCapabilities` vocabulary
   (the **gating** flags `ws` / `sse` / `cell_crud` / `cell_relations` /
   `account_lifecycle` / `fact_serving` / `ready` / `account_status` /
-  `oversized_reject_closes_connection` — each has a `test_if` reader),
+  `oversized_reject_closes_connection` / `peer_request` — each has a `test_if`
+  reader; `peer_request` (server-initiated requests — the `ActionPeer`
+  `peer/ping` round-trip) is `true` only for the Rust spine and `false` for the
+  TS family, whose server request transport is deferred),
   `test_if(cond, name, fn)`
   for capability-gated cases, and `in_process_capabilities` preset. The
   non-gating wiring facts (`bearer_auth` / `trusted_proxy` / `login_rate_limit`,
@@ -1076,6 +1079,30 @@ where one exists (forge) and be offered the role; harmless on the auth-only
 spine. Gated on `capabilities.ws`; cross-process only. fuz_app's own wiring is
 `src/test/cross_backend/role_grant_offer_notification_ws.cross.test.ts`.
 
+### `cross_backend/peer_ping_ws.ts` — `describe_peer_ping_ws_tests`
+
+The server→client **request/response** sibling of the notification suite above —
+the machinery proof for `ActionPeer`. `peer/ping` is `initiator: both`; the
+client→server direction already exists as `heartbeat`, this exercises the new
+server→client one. The observable trigger is a client invoking the `peer/ping`
+**action** over its own socket: the handler initiates a `peer/ping` request back
+to that socket (`ctx.request_client`), awaits the client's echo, validates it
+against `PingResponse`, and returns the validated shape — so one client RPC
+drives the whole round-trip and every outcome (success / `Timeout` / wrong-shape
+/ client-error) surfaces as that RPC's wire response. The client attaches an
+`on_request` responder **at construction** (the `create_ws_transport` seam) so
+the inbound server-initiated request is answered as soon as it arrives; the
+security negatives use the raw `WsClient.send` to inject unsolicited /
+cross-connection frames. Seven cases: the positive round-trip plus
+unsolicited-response rejection, per-connection id isolation, never-reply
+`Timeout`, wrong-shape rejection, client-error forwarding, and the HTTP
+no-transport path. Gated on `capabilities.peer_request` — `true` only on the
+Rust spine (server-initiated requests are Rust-first canonical), so it `.skip`s
+on the TS spines whose server request transport is the deferred convergence
+item; `peer/ping` is a protocol action (manifest-excluded), so parity is
+behavioral here, not via the manifest gate. Cross-process only; fuz_app's own
+wiring is `src/test/cross_backend/peer_ping_ws.cross.test.ts`.
+
 ### `cross_backend/sse_round_trip.ts` — `describe_cross_process_sse_tests`
 
 Cross-process counterpart to the in-process `sse_round_trip.ts` harness —
@@ -1177,12 +1204,19 @@ in-process legs (plain `gro test`) are `src/test/auth/cell_crud_parity.db.test.t
   wire-frame types, and
   predicates (`is_notification`, `is_response_for`, ...). Both in-process
   (`ws_round_trip.ts`) and cross-process (`ws_transport.ts`) impls satisfy
-  this interface.
-- `testing/transports/ws_transport.ts` — `create_ws_transport({base_url, ws_path, cookies, origin?})`
+  this interface. Also owns `deliver_inbound` — the shared
+  parse→(respond|push)→resolve receive core both impls call (so the responder
+  branch is written once) — plus the `WsRequestResponder` / `WsResponderOutcome`
+  types for the **`on_request`** seam: a responder answers a server-initiated
+  request (`{result}` / `{error}` / `undefined` to swallow), the path
+  `describe_peer_ping_ws_tests` drives. With no `on_request` the seam is inert
+  (a server-initiated request flows to `messages` as before).
+- `testing/transports/ws_transport.ts` — `create_ws_transport({base_url, ws_path, cookies, origin?, on_request?})`
   builds a real-upgrade WS client using the `ws` npm package (optional
   peerDep; consumers wiring cross-process tests `npm install --save-dev ws`).
   Threads the keeper cookie onto the upgrade so per-action auth succeeds on
-  the first message.
+  the first message. `on_request` (attached at construction, before the upgrade
+  completes) answers server-initiated requests via the shared `deliver_inbound`.
 - `testing/transports/sse_frame_reader.ts` — `create_sse_frame_reader(reader, default_timeout_ms?)`,
   the transport-agnostic SSE framing core over a
   `ReadableStreamDefaultReader<Uint8Array>`: `\n\n` framing, per-read timeout,

package/dist/testing/cross_backend/capabilities.d.ts

@@ -139,12 +139,33 @@ export interface BackendCapabilities {
      * smuggle detector. See `docs/security.md` §"Body Size Limiting".
      */
     readonly oversized_reject_closes_connection: boolean;
+    /**
+     * The backend can **initiate** a JSON-RPC request to a connected client
+     * and await its typed reply (the server→client request/response direction
+     * `ActionPeer` adds). Gates `describe_peer_ping_ws_tests` — the on-demand
+     * `peer/ping` round-trip plus its security negatives (unsolicited-response
+     * rejection, per-connection id isolation, never-replying `Timeout`,
+     * wrong-shape reply rejection).
+     *
+     * `true` for the Rust spine (server-initiated requests landed Rust-first
+     * canonical); `false` for the TS family — the TS server
+     * `BackendWebsocketTransport.send()` request path is the deferred
+     * twin-impl convergence item, so a TS backend can't yet drive the
+     * round-trip. Like ws/sse/cells, `peer/ping` stays off the standard
+     * declared surface (it's a protocol action, manifest-excluded), so this
+     * flag is the only opt-in into the peer parity coverage.
+     */
+    readonly peer_request: boolean;
 }
 /**
- * Capability declarations for the in-process Hono transport. Every flag
- * is `true` because in-process testing exercises the full backend with
- * no missing optional behaviors. Cross-process consumers
- * declare each flag explicitly per backend.
+ * Capability declarations for the in-process Hono transport. Nearly every
+ * flag is `true` because in-process testing exercises the full backend
+ * with no missing optional behaviors. The one exception is `peer_request`:
+ * the in-process driver runs the **TS** server (`register_action_ws`),
+ * whose server-initiated request transport is deferred, so it can't drive
+ * a `peer/ping` round-trip — and `describe_peer_ping_ws_tests` is
+ * cross-process-only regardless. Cross-process consumers declare each flag
+ * explicitly per backend.
  */
 export declare const in_process_capabilities: BackendCapabilities;
 /**

package/dist/testing/cross_backend/capabilities.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"capabilities.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/capabilities.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAwC9B;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,iBAAiB;IACjC;;;;;OAKG;IACH,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B;;;;;OAKG;IACH,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC;;;;OAIG;IACH,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC;CACnC;AAED;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB;IACnC;;;;OAIG;IACH,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB;;;;;OAKG;IACH,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;IACtB;;;;;;;OAOG;IACH,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;IACpC;;;;;;;;OAQG;IACH,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B;;;;;;;;OAQG;IACH,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB;;;;;;;;OAQG;IACH,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC;;;;;;;;;;;;;;;;;OAiBG;IACH,QAAQ,CAAC,kCAAkC,EAAE,OAAO,CAAC;CACrD;AAED;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB,EAAE,mBAUpC,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,EAAE,iBAInC,CAAC;AAEH;;;;;;;;GAQG;AACH,eAAO,MAAM,OAAO,GAAI,MAAM,OAAO,EAAE,MAAM,MAAM,EAAE,IAAI,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAG,IAMrF,CAAC"}
+{"version":3,"file":"capabilities.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/capabilities.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAwC9B;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,iBAAiB;IACjC;;;;;OAKG;IACH,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B;;;;;OAKG;IACH,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC;;;;OAIG;IACH,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC;CACnC;AAED;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB;IACnC;;;;OAIG;IACH,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB;;;;;OAKG;IACH,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;IACtB;;;;;;;OAOG;IACH,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;IACpC;;;;;;;;OAQG;IACH,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B;;;;;;;;OAQG;IACH,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB;;;;;;;;OAQG;IACH,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC;;;;;;;;;;;;;;;;;OAiBG;IACH,QAAQ,CAAC,kCAAkC,EAAE,OAAO,CAAC;IACrD;;;;;;;;;;;;;;;OAeG;IACH,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;CAC/B;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,uBAAuB,EAAE,mBAWpC,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,EAAE,iBAInC,CAAC;AAEH;;;;;;;;GAQG;AACH,eAAO,MAAM,OAAO,GAAI,MAAM,OAAO,EAAE,MAAM,MAAM,EAAE,IAAI,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAG,IAMrF,CAAC"}

package/dist/testing/cross_backend/capabilities.js

@@ -36,10 +36,14 @@ import '../assert_dev_env.js';
  */
 import { test } from 'vitest';
 /**
- * Capability declarations for the in-process Hono transport. Every flag
- * is `true` because in-process testing exercises the full backend with
- * no missing optional behaviors. Cross-process consumers
- * declare each flag explicitly per backend.
+ * Capability declarations for the in-process Hono transport. Nearly every
+ * flag is `true` because in-process testing exercises the full backend
+ * with no missing optional behaviors. The one exception is `peer_request`:
+ * the in-process driver runs the **TS** server (`register_action_ws`),
+ * whose server-initiated request transport is deferred, so it can't drive
+ * a `peer/ping` round-trip — and `describe_peer_ping_ws_tests` is
+ * cross-process-only regardless. Cross-process consumers declare each flag
+ * explicitly per backend.
  */
 export const in_process_capabilities = Object.freeze({
     ws: true,
@@ -51,6 +55,7 @@ export const in_process_capabilities = Object.freeze({
     ready: true,
     account_status: true,
     oversized_reject_closes_connection: true,
+    peer_request: false,
 });
 /**
  * Shape notes for the in-process Hono transport — every wiring fact present

package/dist/testing/cross_backend/cell_crud.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cell_crud.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/cell_crud.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAsD9B,OAAO,KAAK,EAAC,wBAAwB,EAAC,MAAM,YAAY,CAAC;AAGzD,eAAO,MAAM,8BAA8B,GAAI,SAAS,wBAAwB,KAAG,IAwSlF,CAAC"}
+{"version":3,"file":"cell_crud.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/cell_crud.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAsD9B,OAAO,KAAK,EAAC,wBAAwB,EAAC,MAAM,YAAY,CAAC;AAGzD,eAAO,MAAM,8BAA8B,GAAI,SAAS,wBAAwB,KAAG,IA6VlF,CAAC"}

package/dist/testing/cross_backend/cell_crud.js

@@ -83,6 +83,29 @@ export const describe_cell_crud_cross_tests = (options) => {
             assert.ok(!gone.ok, 'deleted cell still readable');
             assert.strictEqual(error_reason(gone), 'cell_not_found');
         });
+        test_if(capabilities.cell_crud, 'refs are deduped and lexicographically sorted (deterministic, cross-impl-identical)', async () => {
+            const fixture = await setup_test();
+            const owner = await fixture.create_account({ username: 'cell_refs_owner' });
+            const t = fixture.fresh_transport();
+            const owner_headers = owner.create_session_headers();
+            // Three valid distinct fact hashes that sort a < b < c, embedded in
+            // `data` in a deliberately unsorted, nested, duplicated order. Both
+            // spines must derive `refs` as the sorted [a, b, c] regardless of
+            // traversal order or `HashSet` iteration — the byte-identical
+            // cross-backend contract (Rust `extract_refs` ↔ TS `derive_refs`).
+            const ref_a = `blake3:${'a'.repeat(64)}`;
+            const ref_b = `blake3:${'b'.repeat(64)}`;
+            const ref_c = `blake3:${'c'.repeat(64)}`;
+            const sorted = [ref_a, ref_b, ref_c];
+            const created = expect_output(await cross_rpc_call(t, rpc_path, 'cell_create', { data: { kind: 'note', cover: ref_c, nested: { attachments: [ref_b, ref_a, ref_b] } } }, owner_headers), CellCreateOutput);
+            assert.deepStrictEqual(created.cell.refs, sorted, 'create did not return sorted refs');
+            // Read it back — the stored column round-trips sorted too.
+            const got = expect_output(await cross_rpc_call(t, rpc_path, 'cell_get', { id: created.cell.id }, owner_headers), CellGetOutput);
+            assert.deepStrictEqual(got.cell.refs, sorted, 'get did not return sorted refs');
+            // Update reorders the embedded refs — the new column is still sorted.
+            const updated = expect_output(await cross_rpc_call(t, rpc_path, 'cell_update', { cell_id: created.cell.id, data: { refs: [ref_b, ref_c, ref_a] } }, owner_headers), CellUpdateOutput);
+            assert.deepStrictEqual(updated.cell.refs, sorted, 'update did not return sorted refs');
+        });
         test_if(capabilities.cell_crud, 'anon sees public cells only; private is 404', async () => {
             const fixture = await setup_test();
             const owner = await fixture.create_account({ username: 'cell_anon_owner' });

package/dist/testing/cross_backend/default_backend_configs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"default_backend_configs.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/default_backend_configs.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,KAAK,EAAC,sBAAsB,EAAE,aAAa,EAAC,MAAM,qBAAqB,CAAC;AAC/E,OAAO,KAAK,EAAC,mBAAmB,EAAE,iBAAiB,EAAC,MAAM,mBAAmB,CAAC;AAC9E,OAAO,EAA2B,KAAK,gBAAgB,EAAC,MAAM,+BAA+B,CAAC;AAQ9F;;;;;;;;;;GAUG;AACH,eAAO,MAAM,4BAA4B,iCAAiC,CAAC;AAE3E;;;;GAIG;AACH,eAAO,MAAM,uBAAuB,EAAE,mBAiBpC,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,EAAE,mBAgBtC,CAAC;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,EAAE,iBAInC,CAAC;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB,EAAE,iBAIrC,CAAC;AAeH,MAAM,WAAW,iCAAiC;IACjD,gFAAgF;IAChF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,sCAAsC;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,4DAA4D;IAC5D,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC9C,oDAAoD;IACpD,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,iEAAiE;IACjE,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACtD,6CAA6C;IAC7C,QAAQ,CAAC,YAAY,CAAC,EAAE,mBAAmB,CAAC;IAC5C,wEAAwE;IACxE,QAAQ,CAAC,KAAK,CAAC,EAAE,gBAAgB,CAAC;IAClC,sEAAsE;IACtE,QAAQ,CAAC,mBAAmB,CAAC,EAAE,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAC/D;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;;;OAMG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED;;;;;GAKG;AACH,eAAO,MAAM,8BAA8B,GAC1C,MAAM,iCAAiC,KACrC,aAoCF,CAAC;AAEF,MAAM,WAAW,mCAAmC;IACnD,gFAAgF;IAChF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,sCAAsC;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,4DAA4D;IAC5D,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC9C;;;;OAIG;IACH,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,iEAAiE;IACjE,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACtD,+CAA+C;IAC/C,QAAQ,CAAC,YAAY,CAAC,EAAE,mBAAmB,CAAC;IAC5C,wEAAwE;IACxE,QAAQ,CAAC,KAAK,CAAC,EAAE,gBAAgB,CAAC;IAClC,sEAAsE;IACtE,QAAQ,CAAC,mBAAmB,CAAC,EAAE,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAC/D;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B;;;OAGG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED;;;;;GAKG;AACH,eAAO,MAAM,gCAAgC,GAC5C,MAAM,mCAAmC,KACvC,aA4CF,CAAC"}
+{"version":3,"file":"default_backend_configs.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/default_backend_configs.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAE9B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,KAAK,EAAC,sBAAsB,EAAE,aAAa,EAAC,MAAM,qBAAqB,CAAC;AAC/E,OAAO,KAAK,EAAC,mBAAmB,EAAE,iBAAiB,EAAC,MAAM,mBAAmB,CAAC;AAC9E,OAAO,EAA2B,KAAK,gBAAgB,EAAC,MAAM,+BAA+B,CAAC;AAQ9F;;;;;;;;;;GAUG;AACH,eAAO,MAAM,4BAA4B,iCAAiC,CAAC;AAE3E;;;;GAIG;AACH,eAAO,MAAM,uBAAuB,EAAE,mBAqBpC,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,EAAE,mBAmBtC,CAAC;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,EAAE,iBAInC,CAAC;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB,EAAE,iBAIrC,CAAC;AAeH,MAAM,WAAW,iCAAiC;IACjD,gFAAgF;IAChF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,sCAAsC;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,4DAA4D;IAC5D,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC9C,oDAAoD;IACpD,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,iEAAiE;IACjE,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACtD,6CAA6C;IAC7C,QAAQ,CAAC,YAAY,CAAC,EAAE,mBAAmB,CAAC;IAC5C,wEAAwE;IACxE,QAAQ,CAAC,KAAK,CAAC,EAAE,gBAAgB,CAAC;IAClC,sEAAsE;IACtE,QAAQ,CAAC,mBAAmB,CAAC,EAAE,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAC/D;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;;;OAMG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED;;;;;GAKG;AACH,eAAO,MAAM,8BAA8B,GAC1C,MAAM,iCAAiC,KACrC,aAoCF,CAAC;AAEF,MAAM,WAAW,mCAAmC;IACnD,gFAAgF;IAChF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,sCAAsC;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,4DAA4D;IAC5D,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC9C;;;;OAIG;IACH,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,iEAAiE;IACjE,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACtD,+CAA+C;IAC/C,QAAQ,CAAC,YAAY,CAAC,EAAE,mBAAmB,CAAC;IAC5C,wEAAwE;IACxE,QAAQ,CAAC,KAAK,CAAC,EAAE,gBAAgB,CAAC;IAClC,sEAAsE;IACtE,QAAQ,CAAC,mBAAmB,CAAC,EAAE,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAC/D;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B;;;OAGG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED;;;;;GAKG;AACH,eAAO,MAAM,gCAAgC,GAC5C,MAAM,mCAAmC,KACvC,aA4CF,CAAC"}

package/dist/testing/cross_backend/default_backend_configs.js

@@ -35,6 +35,10 @@ export const ts_default_capabilities = Object.freeze({
     // posture). A Bun-served consumer overrides to `false` (see the bun spine
     // config) — fail-loud rather than silently skipping the smuggle detector.
     oversized_reject_closes_connection: true,
+    // The TS server can't yet initiate server→client requests (the
+    // `BackendWebsocketTransport.send()` request path is the deferred
+    // twin-impl convergence), so the TS family skips the peer/ping suite.
+    peer_request: false,
 });
 /**
  * Capabilities for the Rust family. The non-gating wiring facts live in
@@ -57,6 +61,9 @@ export const rust_default_capabilities = Object.freeze({
     // hyper sends an RST on the oversized-body reject — the connection closes
     // and the pipelined request is never reached.
     oversized_reject_closes_connection: true,
+    // Server-initiated requests landed Rust-first canonical — the Rust spine
+    // drives the `peer/ping` round-trip, so the family opts into the suite.
+    peer_request: true,
 });
 /**
  * Shape notes for TS-family backends — wiring facts, not gating flags.